Loading malware…
LegionRelay is a lightweight PowerShell-based remote access trojan used by the GREYVIBE threat cluster in espionage-focused operations targeting Ukraine and Ukraine-related entities since at least 2025. It communicates with command-and-control infrastructure through REST API methods and has been deployed in Windows-focused intrusion chains associated with fraudulent adult-club lures and charity-themed websites. Reported operator activity shows LegionRelay being used for file enumeration and theft, screenshot capture, browser data theft, extraction of Telegram and WhatsApp data, and setup of Remote Desktop access for follow-on operations. The malware has been associated with campaigns affecting military, government, civilian, and business-related targets, including confirmed Ukrainian combatants. LegionRelay has also been notable for implementation flaws that exposed limited backend functionality, contributing to unusually strong visibility into operator behavior. GREYVIBE has been assessed as a Russian-speaking, Russia-aligned threat actor with ties to the broader cybercrime ecosystem, and LegionRelay is one of its custom implants used alongside other tooling such as PhantomRelay and FallSpy.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lastly, WithSecure identified design flaws in LegionRelay, a custom malware associated with GREYVIBE... LegionRelay is a lightweight PowerShell-based RAT that communicates with its command-and-control server through REST API methods.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
The group has used fake female personas on Telegram, including via local dating channels, to build trust with victims before directing them to the lure sites or delivering malware directly.
Observed indicators suggest AI-assisted activity across: Resource development, including the development of obfuscation and loader scripts (LOOKVALJS, DAYLIGHT, TEASOUP), full-stack development of LegionRelay, and backend infrastructure setup and configuration.
A notable and persistent campaign, tracked as PrincessClub, used fake Ukrainian adult-club websites to deliver FallSpy on Android and PhantomRelayV1 or LegionRelay on Windows.
The group has leveraged multiple attack vectors, including spear-phishing e-mails, fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware to a diverse set of victims.
Initially, the threat actors initiated at least six unique email-based campaigns. These malicious messages deliver dangerous compression archives hosted on popular public storage services. Furthermore, the files contain automated script loaders that deploy localized documents.
victims were instructed, in Ukrainian, to run commands under the pretext of completing a Cloudflare-themed security verification process, while the executed command initiated a PhantomRelay infection chain in the background.
Subsequently, the interface instructs landing users to execute localized commands. These commands quietly spawn the primary backdoor client while redirecting users to safe destinations.
Across these campaigns, the group has relied on custom developed obfuscators, loaders, and malware... WithSecure found evidence of AI assistance across multiple parts of the operation... obfuscation scripts...
Associated domains masqueraded as Zoom conference and LAPAS (Latvian Platform for Development Cooperation) websites.
WithSecure observed operators using LegionRelay for file enumeration, file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, RDP access setup, among other actions.
WithSecure observed operators using LegionRelay for file enumeration, file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, RDP access setup, among other actions.
LegionRelay is a lightweight PowerShell-based RAT that supports ... browser data theft...
WithSecure observed operators using LegionRelay for file enumeration, file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, RDP access setup, among other actions.
WithSecure observed operators using LegionRelay for file enumeration, file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, RDP access setup, among other actions.
WithSecure observed operators using LegionRelay for file enumeration, file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, RDP access setup, among other actions.
Later iterations of the lure sites introduced a WebRTC-based live call feature, accessible only post-infection, that could capture victim audio and video, turning the lure site from a static decoy into a potential human intelligence (HUMINT) collection mechanism.
Later iterations of the lure sites introduced a WebRTC-based live call feature, accessible only post-infection, that could capture victim audio and video, turning the lure site from a static decoy into a potential human intelligence (HUMINT) collection mechanism.
LegionRelay is a lightweight PowerShell-based RAT that communicates with its command-and-control server through REST API methods.
Its capabilities are extended through additional PowerShell scripts delivered by the C2 and dynamically executed on the victim machine.
LegionRelay is a lightweight PowerShell-based RAT that supports ... file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration...
The deployment of XMRig miner on a small number of LegionRelay-infected machines
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.